cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

www.archline.hu — clean post-compromise baseline #2

Merged
imre.agent merged 88 commits from baseline/47 into main 2026-07-16 14:40:45 +02:00
Conversation 0 Commits 88 Files Changed 24297 +3794619 -31
imre.agent commented 2026-07-16 14:39:17 +02:00
Owner
Copy Link

What this is

The clean, post-compromise code baseline of the www.archline.hu docroot (Joomla 3.8.11) — a malware-free, faithful reproduction of the live server's source files, used as the known-good reference for the HIDS baseline-diff. The repo stores the baseline constituents plus a generator; it is not the deployed tree.

Build it

git clone --recurse-submodules <this repo>
cd www_archline_hu && ./build-baseline.sh    # -> out/ = the deployed code baseline

Prerequisites: bash, rsync, git. No PHP, no network. Full guide in README.md.

Verification (against the live RO mirror)

out/ = ~23,544 files. Byte-matches live for all legit code; intentionally clean on the 4 attacker-infected files so the HIDS flags them on live. Non-malware code residual = 0.

Structure

core/ (Joomla 3.8.11 package) · packages/ (5 upstream extensions; modified ones show the delta vs upstream in git history) · deployed/ (~55 no-source extensions) · cadline/ (own-code; common_cadline_libraries + maintenance are submodules of the developer repos) · overrides/ (core modifications). Malware and runtime data excluded.

🤖 Generated with Claude Code

## What this is The clean, post-compromise **code baseline** of the www.archline.hu docroot (Joomla 3.8.11) — a malware-free, faithful reproduction of the live server's source files, used as the known-good reference for the HIDS baseline-diff. The repo stores the baseline **constituents** plus a generator; it is not the deployed tree. ## Build it git clone --recurse-submodules <this repo> cd www_archline_hu && ./build-baseline.sh # -> out/ = the deployed code baseline Prerequisites: bash, rsync, git. No PHP, no network. Full guide in README.md. ## Verification (against the live RO mirror) `out/` = ~23,544 files. Byte-matches live for all legit code; intentionally **clean** on the 4 attacker-infected files so the HIDS flags them on live. **Non-malware code residual = 0.** ## Structure `core/` (Joomla 3.8.11 package) · `packages/` (5 upstream extensions; modified ones show the delta vs upstream in git history) · `deployed/` (~55 no-source extensions) · `cadline/` (own-code; `common_cadline_libraries` + `maintenance` are **submodules** of the developer repos) · `overrides/` (core modifications). Malware and runtime data excluded. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
imre.agent added 88 commits 2026-07-16 14:39:17 +02:00 
Establish the www.archline.hu clean-baseline repo. This root commit on main
documents the baseline definition (only our code, deployable) and the
reproducible per-commit reconstruction method used on the build branch.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Re-architect the baseline as constituents + a generator script (build-baseline.sh)
instead of a checked-out deployed tree: a deployed Joomla docroot differs from the
repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py),
places no-source and Cadline files, applies core overrides, excludes malware/data,
and emits out/ = the code baseline the operator HIDS verifier consumes.

Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Official Joomla_3.8.11-Stable-Full_Package (downloads.joomla.org), installer dir
removed. This is the clean deployed core; it byte-matches the live core for the
legit files and provides clean versions of the 3 files the attacker trojanized
(auth/joomla.php credential-stealer, session/storage.php, event/event.php).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
K2 2.8.0 (JoomlaWorks), vetted clean from live; no version-matching upstream package (getk2/k2 has no 2.8.0 tag) → deployed files. Bundles elFinder (admin file-manager attack surface).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
JoomGallery 3.3.4, vetted clean from live; no 3.3.4 tag upstream → deployed files. Excluded temp/ update-staging (data).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Windwalker 2.1.18 (Asika; RemoteImage dependency), vetted clean from live; branch-only upstream → deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
sh404SEF SEF/URL component (Weeblr), vetted clean from live; upstream gated and discontinued for Joomla 3 -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
JCK Editor (WebxSolution, com_jckman 6.4.4 + editors/jckeditor 6.6.2); dead vendor, no upstream -> deployed files; manual CVE-2018-17254 mitigation on menunodes.php preserved.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
SP Page Builder (JoomShaper); GitHub exposes only 1.x, the installed 3.6.2 is gated -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
iCagenda (Cyril Reze / Jooml!C); upstream dead and clone 404 -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Akeeba Backup Core (Akeeba Ltd) + FOF 2.4.3/FOF30 3.3.4/FEF libraries; exact 6.1.1 not publicly downloadable -> deployed files (code only, no backup archives).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Convert Forms (Tassos Marinos) + bundled NR Framework dependency; commercial vendor-zip, Pro files may be absent -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Regular Labs (Peter van Westen): Advanced Module Manager 7.7.1 + Sourcerer 7.4.0 + Modals 9.13.0 + RegularLabs library 18.12.3953; commercial (regularlabs.com) -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
AcyMailing (Acyba); installed 6.2.0 is on an EOL branch, only 7.7.5+ published -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
MightySites (AlterBrains, com 3.2.5 / plg 2.1.5); subscription-only, no public download -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
JSN / JoomlaShine (JSN Project) component + framework + modules + plugins; vendor closed in 2021 -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Jumi (Edvard Ananyan); business closed, no clean J3 upstream -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
TF Learn (Tech Fry) + techfry library 1.3.4; login-gated, no repo -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Smart Countdown 3 (Alex Polonski, com 3.4.5 / mod 3.4.7); no repo -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Smart Shoutbox (The Krotek); no repo -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Slideshow CK (Cedric Keiflin, com 2.5.2 / mod 2.5.0); vendor login-gated -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Social Login and Social Share (LoginRadius); repo deleted after CIAM pivot -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
SP Easy Image Gallery (JoomShaper); no version-matching upstream package -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
IceMegaMenu (IceTheme, mod 3.0.1 / plg 3.0.0) -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Image Swoop module (Template Monster) -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Helix3 (JoomShaper) template + system/ajax plugins; the live templates/shaper_helix3/index.php was fbwjedi-cloaking-infected and is replaced with the clean monolith copy -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
OL K2 Timeline module (olwebdesign); no identifiable upstream -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
BT Google Maps module (BowThemes); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
OS Touch Slider module + ajax plugin (OrdaSoft); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
jFlickr module (Joomla Bamboo); vendor unverified -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
JUX Timeline module (JoomlaUX); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
MX Timeline module (mixwebtemplates); no identifiable source -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
UT Joomstagram module (Unitemplates.com); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
XpertScroller module (ThemeXpert); registration-gated vendor -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
AnyCode module (Hyde-Design); vendor unverified -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
FlippingBook module (eucoders.com); vendor unverified -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Joombig Notebook Flip module (joombig.com); no authentic source -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
SP Quick Contact module (JoomShaper); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
SP Simple Gallery module (JoomShaper); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
mod_articles_news_adv module (mislabeled Joomla! Project); unmapped clone -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
mod_estore module (mislabeled Joomla! Project); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
mod_login2 module (mislabeled Joomla! Project); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
mod_caroufredsel module; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
mod_image_split_view module; no manifest version, unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
mod_ppc_simple_spotlight module (Pixel Point Creative); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
mod_helloworld sample module (Tutorials Point tutorial sample) -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
YouTubeR (ZyX): system plugin 1.49 + editors-xtd button 1.41; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
JoomlaWorks AllVideos content plugin; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
JoomlaWorks Simple Image Gallery content plugin; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
SocialNetworks (eMediaCom): authentication + user plugins + library; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Fancybox system plugin (Yireo); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
MooTable system plugin (Roberto Segura); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
EU Cookie Directive Lite system plugin (Channel Digital); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
ExtBlank system plugin (Convergence Services); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
TM Lazy Load system plugin (Template Monster); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
P3P system plugin (Joomla! Project label, no manifest version); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
XEF library (Parvez Akther); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
_theme3037 template (TemplateMonster.com); unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
trada template (saihoai); the dropped webshell html/mod_articles_category/meant.php is excluded; unmapped -> deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Generic Joomla 3.x manifest -> deployed-path mapper (component/module/plugin/
library/template/package), used to author the pristine (upstream) commit of a
packages/<slug> module before it is reconciled to the live bytes. 18/18 tests
green; ruff/mypy-strict clean.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Pristine OneAll 5.5.0 manifest-mapped from github.com/oneall/social-login-joomla @5.5.0 via lib/jmap.py to deployed layout. The next commit reconciles to the live bytes; the diff is the full delta vs upstream (line-endings + install files + Cadline CRM modification).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to the vetted live deployed files (byte-truth for HIDS verification). The diff vs the previous commit is the full delta from pristine upstream: line-endings, Joomla-deployed install files, and the Cadline CRM integration in the system plugin (+ default.php blankframe branch). Vetted malware-free; SQLi code-quality follow-up noted in PROVENANCE.md.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Pristine Phoca Download 3.1.2 manifest-mapped from github.com/PhocaCz/PhocaDownload @3.1.2 via lib/jmap.py.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to live bytes. Diff vs pristine = Cadline modifications (trial-download flow, Hungarian routes, DB query — ~10 files per audit) + line-endings/install files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Pristine Easy File Uploader manifest-mapped from github.com/ollily/easyfileuploader via lib/jmap.py (upstream master; installed 2.7.8).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Reconcile to live bytes. Diff vs pristine = Cadline modification (ARCHLine.XP 2024 Rendering contest upload form, ~3 files) + version drift/line-endings.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
RemoteImage 2.0.10 (github.com/asikart/remoteimage @2.0.10), vetted clean, stock; live deployed files (upstream ships build-layout — deployed bytes used for verification).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Phoca Commander 3.0.2 (github.com/PhocaCz/PhocaCommander @3.0.2), vetted clean, stock admin file-manager; live deployed files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
The ~24 legit Cadline customizations on the Joomla core (audit sec.16.1):
reCAPTCHA anti-spam (registration/reset/remind/login flow, captcha rule),
content view tweaks, mod_login template, phpversioncheck. build-baseline.sh
overlays these live versions onto the official-package core so the baseline
matches live for the legit mods, while the 3 trojanized core files stay clean.
NOTE: com_users/controllers/registration.php carries a hardcoded reCAPTCHA
secret (redacted; rotate on cleanup) — see malware-iocs.md.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
9 Cadline-only components (no public upstream): showroom, albanner, alworkshops, followedlinks, nonprofit, presentation, project, tcexam, versions. Vetted live files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
11 Cadline-only modules (mod_al_*, mod_alusers, mod_alworkshops, mod_course_list, mod_webinar*, mod_wsregister). Dropped webshells excluded (mod_al_upload/b8.php, mod_course_list/a1.php); legit module bases kept.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
plg content/workshopdates; templates blankframe, category. Dropped Tiny File Manager backdoor (templates/category/tiny.php) excluded.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
common_cadline_libraries (CRM hardlock/db/users classes; upstream cadline_web/cadcommonlib), maintenance/ (ARCHLine.XP license backend; upstream cadline_web/maintenance), maintenance2/. Vetted live files (byte-truth); upstream repos in PROVENANCE.md. NOTE: could be git submodules — kept as live files for byte-fidelity.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Docroot sub-apps beiratkozas/, iskolak/, phpext/; root PHPs crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php, recaptchalib.php, configuration.php (74-byte MightySites multi-site stub, legit). public/ excluded (user data, ~219k files).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Cross-extension shared code the baseline was missing: en-GB/hu-HU language (admin+site), libraries/vendor (Composer deps), administrator/manifests (installed-extension metadata). Malware-ext entries and scan artifacts excluded.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
beez3 css/js/language + system modal.php/template.php present on live but absent from the downloaded package build; clean core template files.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
components/com_akeeba (frontend) — the admin side was added earlier; this completes the module.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
components/com_advancedmodules (RegularLabs) frontend — completes the module.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Cadline/JSN additions to com_users: recaptchalib.php (anti-spam), easyprofile.php views (JSN EasyProfile) — only-in-live files not caught by the core-override diff.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Completeness: administrator/postupdate.php + isis/js/_template.js (clean core
files absent from the downloaded package), bin/windwalker (Windwalker CLI),
sbtrack.php (Cadline tracking docroot PHP). All vetted malware-free.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
build-baseline.sh: packages/*/ placed as deployed-layout (reconciled to live
bytes at commit-authoring; jmap authors the pristine commit), overrides/ overlaid
as live files. Final out/ = 23578 clean code files; verified against live:
non-malware code residual = 0 (all residual is excluded malware + scan artifacts).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Note the byte-fidelity decisions (cadcommonlib/maintenance as live files not
submodules; public/ excluded as data) and the verification outcome (out/ =
23,578 files, non-malware code residual = 0).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
This repo lives on the customer Gitea (git.cadline.hu); drop references to the
operator's internal Gitea repos (audit/incident tracker, HIDS verifier) and
describe those generically instead.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
The developer-controlled Cadline repos (cadcommonlib, maintenance) become git
submodules so updates flow through: git submodule update --remote -> build ->
commit new pointers. Pinned to their authoritative HEADs. build-baseline.sh
inits the submodules and normalizes their CRLF to LF (the deploy transform) so
the assembled baseline byte-matches the deployed form. constants.php (live-only
config, not in the repo; carries a DB credential tracked in the credential
inventory) is kept as an overlay (overrides/) per instruction — removal happens
at source later.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Live has mixed CRLF/LF and content drift vs the submodule HEADs, so normalizing
would break the currently-matching files. The baseline reflects the authoritative
developer repos; line-ending handling is a verifier concern.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
--exclude='cache/' matched any nested dir named cache (e.g. core
com_cache/views/cache/); anchor cache/tmp/logs/images excludes to the docroot
root so only runtime-data top-level dirs are dropped. Non-malware code residual
now 0 (remaining residual is excluded malware + scan artifacts).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Front-and-center, runnable steps to produce the baseline: clone
--recurse-submodules, run ./build-baseline.sh, use out/ as the vanilla_ref.
Documents prerequisites (no PHP/network; jmap.py is authoring-only), what out/
contains/excludes, the update workflow (submodule update --remote + rebuild),
and the current common_cadline_libraries/maintenance divergence.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
jmap.py is an authoring-only tool and is not invoked at build time; remove the
dead variable so the script matches the README.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
imre.agent merged commit 6ff90db3f2 into main 2026-07-16 14:40:45 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: cadline_web/www_archline_hu#2
No description provided.
Delete Branch "baseline/47"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?